Context: Why DORA Affects Cloud & SaaS Vendors
The EU Digital Operational Resilience Act (DORA - Regulation (EU) 2022/2554) came into full statutory application in January 2025.
While DORA formally regulates financial entities (banks, investment firms, insurers, payment providers), its Pillar IV rules on Third-Party ICT Risk (Articles 28–44) place direct legal obligations on regulated entities to audit and enforce resilience on their third-party technology providers.
If your software or infrastructure supports a critical financial function, your financial clients must obtain specific contractual commitments, audit rights, and telemetry from you by law.
The First 10 Due-Diligence Questions You Must Answer
1. Function Criticality & Service Mapping
Can you clearly articulate whether your software supports a critical or important function of your client, and provide an architectural data-flow diagram showing where their data resides?
2. Sub-outsourcing Transparency (Article 30)
Do you maintain an up-to-date register of your own sub-contractors (e.g. AWS hosting, SendGrid, Datadog), and do your contracts promise advance written notification before changing a critical sub-contractor?
3. Contractual Audit & Inspection Rights
Does your customer agreement explicitly grant your client, their external auditors, and competent financial authorities (such as the EBA, ESMA, or national central banks) full rights of access and inspection?
4. Incident Notification Windows
Do you have an automated alert mechanism capable of notifying financial clients of a major ICT security incident within statutory timelines (often initial notice within 4 to 24 hours)?
5. Business Continuity & Disaster Recovery Drills (RTO & RPO)
Do you have formally tested Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) backed by documented restoration drills conducted at least annually?
6. Data Location & Redundancy
Can you guarantee data storage and processing residency within the European Economic Area (EEA) if required by the financial entity's risk policy?
7. Threat-Led Penetration Testing (TLPT)
Are you prepared to cooperate with your clients during mandatory European Threat-Led Penetration Testing exercises (e.g. the TIBER-EU framework)?
8. Exit Strategies & Data Portability
Does your contract include an orderly exit assistance plan that allows your client to transition their data and workloads to another provider or back on-premise without unreasonable friction?
9. Multi-Factor Authentication (MFA) & Encryption
Is modern, phishing-resistant MFA enforced on all engineer access, and is client data encrypted both in transit (TLS 1.3) and at rest (AES-256)?
10. Information Sharing & Vulnerability Disclosure
Do you maintain a responsible vulnerability disclosure policy and a mechanism to exchange actionable threat indicators with your clients?